[6.1.0][bpf] BUG: KASAN: slab-out-of-bounds in copy_array (kernel/bpf/verifier.c:1074)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



We recently started to hit the following issue on the mainline kernel
[1], the call trace is from commit [2]. The first commit we noticed
the problem is [3], although we don't know exactly when it was
introduced.

==================================================================
[   46.073262] BUG: KASAN: slab-out-of-bounds in copy_array
(kernel/bpf/verifier.c:1074)
[   46.074131] Write of size 40 at addr ffff8880079cf840 by task systemd/1
[   46.075043]
[   46.076104] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
[   46.076926] Call Trace:
[   46.077331]  <TASK>
[   46.077670] dump_stack_lvl (lib/dump_stack.c:107 (discriminator 4))
[   46.078240] print_report (mm/kasan/report.c:307 mm/kasan/report.c:417)
[   46.078769] ? __virt_addr_valid (./include/linux/mmzone.h:1783
./include/linux/mmzone.h:1879 arch/x86/mm/physaddr.c:65)
[   46.079389] ? copy_array (kernel/bpf/verifier.c:1074)
[   46.079885] kasan_report (mm/kasan/report.c:184 mm/kasan/report.c:519)
[   46.080430] ? copy_array (kernel/bpf/verifier.c:1074)
[   46.080929] ? kasan_check_range (mm/kasan/generic.c:190)
[   46.081556] ? memcpy (mm/kasan/shadow.c:65 (discriminator 1))
[   46.082006] ? copy_array (kernel/bpf/verifier.c:1074)
[   46.082571] ? copy_verifier_state (kernel/bpf/verifier.c:1250)
[   46.083231] ? pop_stack (kernel/bpf/verifier.c:1315)
[   46.083718] ? do_check_common (kernel/bpf/verifier.c:14031
kernel/bpf/verifier.c:16289)
[   46.084364] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4383)
[   46.084979] ? __pfx_do_check_common (kernel/bpf/verifier.c:16225)
[   46.085644] ? __kmem_cache_free (mm/slub.c:3787 mm/slub.c:3800)
[   46.086244] ? check_cfg (kernel/bpf/verifier.c:12511)
[   46.086766] ? bpf_check (kernel/bpf/verifier.c:16352
kernel/bpf/verifier.c:16936)
[   46.087313] ? __pfx_bpf_check (kernel/bpf/verifier.c:16819)
[   46.087878] ? __pfx___lock_acquire (kernel/locking/lockdep.c:4913)
[   46.088548] ? lock_is_held_type (kernel/locking/lockdep.c:466
kernel/locking/lockdep.c:5712)
[   46.089122] ? find_held_lock (kernel/locking/lockdep.c:5179)
[   46.089697] ? lock_release (kernel/locking/lockdep.c:466
kernel/locking/lockdep.c:5690)
[   46.090261] ? ktime_get_with_offset (./include/linux/seqlock.h:274
kernel/time/timekeeping.c:889)
[   46.090921] ? __pfx_lock_release (kernel/locking/lockdep.c:5676)
[   46.091521] ? __might_fault (mm/memory.c:5647 mm/memory.c:5640)
[   46.092048] ? __might_resched (kernel/sched/core.c:9950)
[   46.092650] ? memset (mm/kasan/shadow.c:44)
[   46.093109] ? bpf_prog_load (kernel/bpf/syscall.c:2619)
[   46.093722] ? __pfx_bpf_prog_load (kernel/bpf/syscall.c:2478)
[   46.094357] ? lock_is_held_type (kernel/locking/lockdep.c:466
kernel/locking/lockdep.c:5712)
[   46.094963] ? __sys_bpf (kernel/bpf/syscall.c:4979)
[   46.095496] ? __pfx___sys_bpf (kernel/bpf/syscall.c:4926)
[   46.096073] ? mark_held_locks (kernel/locking/lockdep.c:4224)
[   46.096658] ? __x64_sys_bpf (kernel/bpf/syscall.c:5081)
[   46.097187] ? do_syscall_64 (arch/x86/entry/common.c:50
arch/x86/entry/common.c:80)
[   46.097753] ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)
[   46.098510]  </TASK>
[   46.098830]
[   46.099066] Allocated by task 1:
[   46.099597] kasan_save_stack (mm/kasan/common.c:46)
[   46.100146] kasan_set_track (mm/kasan/common.c:52)
[   46.100705] __kasan_krealloc (mm/kasan/common.c:371 mm/kasan/common.c:439)
[   46.101295] krealloc (./include/linux/kasan.h:231
mm/slab_common.c:1361 mm/slab_common.c:1398)
[   46.101754] push_jmp_history (kernel/bpf/verifier.c:2593)
[   46.102334] do_check_common (kernel/bpf/verifier.c:13552
kernel/bpf/verifier.c:13752 kernel/bpf/verifier.c:16289)
[   46.102908] bpf_check (kernel/bpf/verifier.c:16352
kernel/bpf/verifier.c:16936)
[   46.103439] bpf_prog_load (kernel/bpf/syscall.c:2619)
[   46.103986] __sys_bpf (kernel/bpf/syscall.c:4979)
[   46.104512] __x64_sys_bpf (kernel/bpf/syscall.c:5081)
[   46.105012] do_syscall_64 (arch/x86/entry/common.c:50
arch/x86/entry/common.c:80)
[   46.105613] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)
[   46.106377]
[   46.106641] The buggy address belongs to the object at ffff8880079cf840
[   46.106641]  which belongs to the cache kmalloc-64 of size 64
[   46.108316] The buggy address is located 0 bytes inside of
[   46.108316]  64-byte region [ffff8880079cf840, ffff8880079cf880)
[   46.109904]
[   46.110167] The buggy address belongs to the physical page:
[   46.110981] page:ffffea00001e73c0 refcount:1 mapcount:0
mapping:0000000000000000 index:0xffff8880079cf040 pfn:0x79cf
[   46.112490] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff)
[   46.113456] raw: 000fffffc0000200 ffff888100042900 ffffea00040605d0
ffff8881000406c8
[   46.114534] raw: ffff8880079cf040 000000000010000a 00000001ffffffff
0000000000000000
[   46.115617] page dumped because: kasan: bad access detected
[   46.116394]
[   46.116632] Memory state around the buggy address:
[   46.117339]  ffff8880079cf700: fc fc fc fc fc fc fc fc fc fc fc fc
fc fc fc fc
[   46.118303]  ffff8880079cf780: fc fc fc fc fc fc fc fc fc fc fc fc
fc fc fc fc
[   46.119305] >ffff8880079cf800: fc fc fc fc fc fc fc fc 00 00 00 00
fc fc fc fc
[   46.120328]                                                        ^
[   46.121235]  ffff8880079cf880: fc fc fc fc fc fc fc fc fc fc fc fc
fc fc fc fc
[   46.122299]  ffff8880079cf900: fc fc fc fc fc fc fc fc fa fb fb fb
fb fb fb fb
[   46.123316] ==================================================================

kernel tarball:
https://s3.amazonaws.com/arr-cki-prod-trusted-artifacts/trusted-artifacts/725608072/publish%20x86_64%20debug/3491129543/artifacts/kernel-mainline.kernel.org-redhat_725608072_x86_64_debug.tar.gz

kernel config: https://s3.amazonaws.com/arr-cki-prod-trusted-artifacts/trusted-artifacts/725608072/build%20x86_64%20debug/3491129500/artifacts/kernel-mainline.kernel.org-redhat_725608072_x86_64_debug.config

test logs: https://datawarehouse.cki-project.org/kcidb/tests/6444438
cki issue tracker: https://datawarehouse.cki-project.org/issue/1770

[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[2] f9ff5644bcc04221bae56f922122f2b7f5d24d62
[3] 93761c93e9da28d8a020777cee2a84133082b477

Thank you,
Bruno Goncalves




[Index of Archives]     [Linux Samsung SoC]     [Linux Rockchip SoC]     [Linux Actions SoC]     [Linux for Synopsys ARC Processors]     [Linux NFS]     [Linux NILFS]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]


  Powered by Linux